Auto install Cocoapods when Podfile.lock not exist

[attiasas]

• The pull request is targeting the dev branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• Updated the Contributing page / ReadMe page / CI Workflow files if needed.
• All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

---

fix(cocoapods): auto-install when Podfile.lock is missing

Summary
CocoaPods BOM / dependency-tree generation now detects a missing Podfile.lock and runs pod install (unless SkipAutoInstall is enabled), so audits can proceed without a pre-generated lockfile. CocoaPods test fixtures are reorganized under cocoapods-project, and a new cocoapods-no-lock-file sample project supports integration coverage. The hidden skip-auto-install flag documentation is generalized to reflect support beyond Yarn/NPM only.

Changes

• sca/bom/buildinfo/technologies/cocoapods: After resolving the pod executable, if Podfile.lock is absent and auto-install is allowed, run pod install; if auto-install is skipped, return a clear error. Introduce descriptorFileName / lockFileName constants; split getPodExecPath from getPodVersionAndExecPath and improve version-check error wrapping (podcommand.go, cocoapods.go).
• cli/docs/flags.go: Widen SkipAutoInstall help text to “some package managers.”
• Tests / fixtures: Move existing Podfile / Podfile.lock under tests/testdata/.../cocoapods/cocoapods-project; add cocoapods-no-lock-file fixture (Podfile + minimal Xcode workspace files). Point unit tests at the new path (cocoapods_test.go). Add TestXrayAuditCocoapodsNoLockFile and parameterize testXrayAuditCocoapods by project name (audit_test.go).
• git_test.go: Adjust expected violation applicability / scan counts in two JAS-related git audit tests.

Testing

• TestXrayAuditCocoapods / TestXrayAuditCocoapodsNoLockFile (latter skipped on Windows in code), and full go test ./... / CI as usual.

Notes

• Auto-install assumes a working pod on PATH and a suitable host toolchain (the new audit test skips on Windows for that reason). SkipAutoInstall preserves the previous strict behavior when no lockfile exists.
• git_test.go expectation changes are included in this branch; confirm they match the intended Xray/JAS baseline for your environment if those tests are sensitive to server or graph versions.

[github-actions]

---

🐸 JFrog Frogbot